This post made mainly for the benefit of google, since this took me over a day to solve and I can't possibly be the only one to have run into this problem. Deep geek stuff follows, feel free to skip it.
HTTP specifies a mechanism for the client to negotiate what the content-type of the response will be: the Accepts: header. This is a list of content-types, including asterisks; e.g. text/html, application/xml, text/*, */*. The server is supposed to match the available formats for rendering the requested resource against the list the client has requested and return the resource in the first matching format.
Merb is a lightweight Ruby web framework that's often used for places where a Rails app would be overkill or inappropriate (e.g. somewhere you need to be able to handle concurrent requests without running a whole pack of Mongrels, since Rails isn't threadsafe). Merb supports HTTP content negotiation, but it does not support requested content-types containing only one wildcard (it'll handle text/xml and */*, but not text/*).
Finally, Flash for Windows sends Accepts: text/* in HTTP requests. Flash on Mac and Linux sends Accept-Types: text/*; I have no idea where this comes from, as this header is nonstandard.
Since Flash for Windows sends an Accepts: header, Merb will perform content negotiation and explode messily (returning http status 462), since it doesn't know what to do with text/*. Since Flash for Mac and Linux doesn't, it will happily assume that the client sent */* and proceed merrily on its way. I've talked to the Merb guys and they agree that Flash for Windows just might be a sufficiently popular use case to make it worth fixing this.
So, if you have a Flash app embedded in your app that talks to a Merb app on the server (e.g. a file uploader that provides a progress bar and multi-file uploads) and you're rendering a string of XML as content (e.g. the results of asking an object to produce an XML representation of itself), bypass content negotiation completely by calling render @foo.to_xml, :format => :xml explicitly.
Note to self: clean this up later.